how to verify that an old session is really destroyed?

Question

Um, this might sound a bit weird. We were having some problems with a specific browser under a very specific condition, and finally narrowed down the problem to the fact that we were not properly destroying the old sessions after doing session_regenerate_id(). I believe I have solved this problem by doing session_regenerate_id(true) now, but how does one verify that the previous sessions really do not exist any more? Someone suggested cURL but I cannot find my way around their docs. Sadly(?) the boss does not take 'it just works' for an answer so I'd really appreciate any advice!

Accepted Answer

By default `session_regenerate_id();` will only replace the current session with a new one. So the old session file need not actually get deleted. But doing a `session_regenerate_id( true );` will delete the old session file. ( http://php.net/session_regenerate_id )

To check if old session is deleted you can do something like this

```
<?php
$file=ini_get('session.save_path')."/sess_".session_id();
$gotDeleted = file_exists( $file );
?>
```

You can also do a `session_destroy()`. If you must keep some variables, you can try `unset()` on specific `$_SESSION` values.

how to verify that an old session is really destroyed?

Solution

Problem